CVE-2015-7561: Low severity kubernetes dashboard vulnerability
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
Other sources
Miheer Salunke of Red Hat reports:
When a private image is pulled to a node any other user on the node can use this private image if they know the name of the image. It should be noted that the image name typically includes a SHA hash in the value making it difficult to guess.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7561?
CVE-2015-7561 is considered a medium severity vulnerability due to the potential exposure of private images.
How do I fix CVE-2015-7561?
To fix CVE-2015-7561, upgrade Kubernetes to version 1.2.0-alpha.6 or later and ensure proper image access controls are in place.
Who is affected by CVE-2015-7561?
CVE-2015-7561 affects users of Kubernetes in OpenShift 3 who might have access to private images without proper authorization.
What impact does CVE-2015-7561 have on users?
Users who are aware of the names of private images can potentially use them even if they do not have permission to access these images.
Is CVE-2015-7561 present in all Kubernetes installations?
CVE-2015-7561 specifically affects Kubernetes version 1.2.0-alpha.6 and earlier in the context of OpenShift 3.